Extracted

• • Target
    transferencia interbancaria (BBVA).exe
  • Size 920KB
  • SHA256 2029871b36e36b727b2057f31f5baec2c2d05a865d77633821492dbc9a39cf21
  • MD5 25b343479b27442cd83dc17bbe7f2a4d
  • SHA1 ce1cdc7b93e9b7db351947afa0bd9ee188857c7d
  • SHA512 c6597c83cffe2b1e79b92fc812ab7b475975555dc995ced0fbf6be77a26fef7d9aabe0520cffb0b1ac56b59f023f1b4cfd41997383bc306c24ec9168a8e33d03
  • SSDEEP 24576:G7v9KB4FjCrObFtcZXpljwTpHEQCvoGF4YD:v4FjCabFq1pidHOvvF4
  • TLSH
    T18B1501251C863688CB7F0F78C06319A877F0D80791E6E7693EEC11F9AAE3745CE16952
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondiscoveryagentteslakeyloggerspywarestealertrojan

  • Family: AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Suspicious use of SetThreadContext

  behavioral1behavioral2